Computer‑use agents interact with systems via graphical interfaces, command lines, APIs, scripts, and Model Context Protocol servers. A policy decision may stay invariant across interfaces, yet its executable authorization can be bypassed, a security‑relevant default altered, or a commit issued after the authorized state has changed. We introduce a profile‑bounded protocol for a fixed, versioned deployment: it enumerates effect‑bearing routes and durable sinks, checks a route‑to‑sink enforcement cut, normalizes each concrete request to a canonical effect, issues a route‑bound prepare ticket, and at commit time re‑verifies the route, effect, grant, trace, profile, inventory, and authoritative state. A committed result requires an agreeing sink receipt. Under explicit assumptions we prove profile‑bounded refinement, matched‑effect decision invariance, resistance to alternate‑route laundering and declared cross‑surface recomposition, commit‑time state safety, and receipt‑grounded outcomes. The reference profile registers 12 effect families, five interfaces, and 60 routes. Two structurally distinct runtime mappings generate 3,464 traces over 1,732 scenarios: 960 commits, 2,312 denials, and 192 commits after re‑preparation. An independent checker accepts every retained trace pair and rejects 26/26 semantic regressions; coverage and normalizer suites reject 24/24 and 720/720 mutants; and 168/168 commit probes match their declared outcomes. A frozen‑source audit passes 52 checks across 12 files from two hybrid runtimes and a public authorization substrate. Source‑shaped adapter refinements commit 48/48 instrumented calls and reject 15/15 unbound cases. The resulting guarantees bind the declared profile and its effect semantics.\n\nReview: This work achieves provable cross‑interface authorization by rigorously partitioning routes and sinks and applying multi‑stage verification, offering a reusable framework for trustworthy computation of AI agents in heterogeneous, multimodal environments.